How to Rate-Limit an API Query: Throttling Made Easy

Developers are rate limiting their APIs to improve their application’s security and performance. Learn more about API throttling and rate limits in this blog.

APIs allow you to share your application data with other developers (both internal and external) as well as other apps. As businesses continue to accelerate their API strategies, you as the application manager/owner have to make sure that your application is always secure and high-performing. Well-designed APIs that allow you to throttle API requests are what you need for better security and throughput.

What is API Throttling?

API throttling allows you to control the way an API is used. Throttling allows you to set permissions as to whether certain API calls are valid or not. Throttles indicate a temporary state, and are used to control the data that clients can access through an API. When a throttle is triggered, you can disconnect a user or just reduce the response rate. You can define a throttle at the application, API or user level.

As a developer, you have control over what applications and which users can use your APIs. Just like permissions, a combination of multiple throttles may be used on a single request. You can even have multiple levels of throttling based on the user. For example, you can restrict sensitive information from external developers, while giving access to the same for internal developers.

Why Do You Need Throttling?

APIs are a gateway to your backend resources and throttling offers you an extra layer of protection for those resources.

You can deliver consistent applications by making sure that a single client is not suffocating your applications. Enhanced performance will drastically improve the end-user experience.

You can control user authentication and access by rate limiting APIs at various levels—resource, API or application.

You can design a robust API that can be leveraged by multiple groups based on their access level. Simplified API monitoring and maintenance can help reduce your costs.

What are the Types of Throttling?

Enterprises custom throttle their APIs based on the needs of their organization such as monetization, authentication, security, governance, performance, availability, etc. Here are some general throttling strategies adopted by the industry today to help you decide what your API needs:

Rate-Limit Throttling: This is a simple throttle that enables the requests to pass through until a limit is reached for a time interval. A throttle may be incremented by a count of requests, size of a payload or it can be based on content; for example, a throttle can be based on order totals. This is also known as the API burst limit or the API peak limit.

IP-level Throttling: You can make your API accessible only to a certain list of whitelisted IP addresses. You can also limit the number of requests sent by a certain client IP.

Scope Limit Throttling: Based on the classification of a user, you can restrict access to specific parts of the API—certain methods, functions or procedures. Implementing scope limits can help you leverage the same API across different departments in the organization.

Concurrent Connections Limit: Sometimes your application cannot respond to more than a certain number of connections. In such cases, you need to limit the number of connections from a user/account to make sure that other users don’t face a DoS (Denial of Service) error. This kind of throttling also helps secure your application against malicious cyber-attacks.

Resource-level Throttling (also referred to as Hard Throttling): If a certain query returns a large result set, you can throttle the request so that your SQL engine limits the number of rows returned by using conditions attributes like TOP, SKIP, SQL_ATTR_MAX_ROWS, etc.

Tiers of Throttling: Throttling can be applied at multiple levels in your organization:

API-level throttling

Application-level throttling

User-level throttling

Account-level throttling

How to Throttle an API / Query

Throttling your API is an extremely sensitive process and it can have a huge impact on customer satisfaction, application performance and security. For that reason, I recommend you use our commercial enterprise solutions that have inherent support for throttling:

Hybrid Data Pipeline: offers throttled ODBC, JDBC and OData APIs for popular databases such as IBM DB2, Oracle, SQL Server, MySQL, PostgreSQL, SAP Sybase, Hadoop Hive, Salesforce, Google Analytics and many more. To find out more details, you can check out our blog post on Hybrid Data Pipeline’s throttling capabilities. Furthermore, OData has built-in functions such as $count, $top and $skip to filter the query results passed back to a client. In turn, pagination can help in avoiding throttling restrictions and possible performance degradation. You can learn more about OData here.

OpenAccess SDK: In other cases where you have proprietary enterprise APIs, you can leverage our OpenAccess SDK to deploy a standard SQL interface—ODBC, JDBC, ADO.NET or OLE-DB. The SDK supports several throttling capabilities to meet your API throttling needs. The best part of OpenAccess is that it can easily integrate with your existing security and authentication systems, so it can serve as a true extra layer of protection for your enterprise APIs and the underlying backend resources.

As both these products are extremely unique and powerful, I highly recommend that you discuss your throttling needs with our product experts. Happy throttling!

MySQL, written in C and C++, was first released internally on 23 May 1995. Version 5.1 was released 27 November 2008 and the next version will MySQL 6. In April 2009, Oracle Corporation entered into an agreement to purchase Sun Microsystems, current owners of the MySQL intellectual property. Although the deal was approved by Sun's board of directors, it has not yet been finalized.

Cloud Expo

Cloud Computing & All That
It Touches In One Location Cloud Computing - Big Data - Internet of Things
SDDC - WebRTC - DevOps
Cloud computing is become a norm within enterprise IT.

The competition among public cloud providers is red hot, private cloud continues to grab increasing shares of IT budgets, and hybrid cloud strategies are beginning to conquer the enterprise IT world.

Big Data is driving dramatic leaps in resource requirements and capabilities, and now the Internet of Things promises an exponential leap in the size of the Internet and Worldwide Web.

The world of SDX now encompasses Software-Defined Data Centers (SDDCs) as the technology world prepares for the Zettabyte Age.

Add the key topics of WebRTC and DevOps into the mix, and you have three days of pure cloud computing that you simply cannot miss.

Delegates will leave Cloud Expo with dramatically increased understanding the entire scope of the entire cloud computing spectrum from storage to security.

Cloud Expo - the world's most established event - offers a vast selection of 130+ technical and strategic Industry Keynotes, General Sessions, Breakout Sessions, and signature Power Panels. The exhibition floor features 100+ exhibitors offering specific solutions and comprehensive strategies. The floor also features two Demo Theaters that give delegates the opportunity to get even closer to the technology they want to see and the people who offer it.

Attend Cloud Expo. Craft your own custom experience. Learn the latest from the world's best technologists. Find the vendors you want and put them to the test.